{"id":"CVE-2026-115257","kind":"vulnerability","aliases":["CVE-2026-115257"],"related":[],"title":"WP Roster WordPress plugin: unauthenticated users can overwrite any roster","description":"The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.","summary":"The WP Roster WordPress plugin before 2.36 skips capability and nonce checks when writing its stored roster data. An unauthenticated attacker can overwrite, wipe or restore the content of any roster.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-roster"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Roster version in the WordPress admin plugin list or in the plugin's main file header\n- Compare the installed version against `2.36`; anything older is in the stated range","fix":"- WP Roster: move to `2.36` or later","status":"open","published_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:26:15+00:00","updated_at":"2026-11-04T06:26:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:15Z","model":"claude-haiku-5-5","output":{"fix":"- WP Roster: move to `2.36` or later","reach":"internet","title":"WP Roster WordPress plugin: unauthenticated users can overwrite any roster","impact":"medium","summary":"The WP Roster WordPress plugin before 2.36 skips capability and nonce checks when writing its stored roster data. An unauthenticated attacker can overwrite, wipe or restore the content of any roster.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-roster"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers overwrite, wipe or restore roster content","analyst_note":"","how_to_check":"- Check the installed WP Roster version in the WordPress admin plugin list or in the plugin's main file header\n- Compare the installed version against `2.36`; anything older is in the stated range\n- unknown for other checks, as the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Roster WordPress plugin before 2.36 are exposed, because the write path accepts requests without any login or nonce check. Sites that do not run this plugin, or that have already updated to 2.36 or later, are not affected. unknown for whether specific configurations change exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4092,"output_tokens":505,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115257':13A,16A '-2026':12A,15A '2.36':28B,59C 'allow':74C 'attack':42B,76C 'capabl':30B,64C 'check':33B,67C 'content':49B,83C 'cve':11A,14A 'data':39B,73C 'nonc':32B,66C 'overwrit':8A,44B,78C 'packag':17B 'perform':62C 'plugin':4A,26B,57C 'restor':47B,81C 'roster':2A,10A,21B,24B,38B,52B,55C,72C,86C 'skip':29B 'store':37B,71C 'unauthent':5A,41B,75C 'user':6A 'wipe':45B,79C 'wordpress':3A,18B,25B,56C 'wp':1A,20B,23B,54C 'wp-roster':19B 'write':35B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Roster WordPress plugin before 2.36 are exposed, because the write path accepts requests without any login or nonce check. Sites that do not run this plugin, or that have already updated to 2.36 or later, are not affected. unknown for whether specific configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","wordpress","wproster"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115257","severity":null,"published_at":"2026-11-04T06:17:01+00:00","modified_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}